Privacy policy
Crypto Master brings your exchange accounts and your wallets together so you can see them as one. Doing that means handling data that belongs to you. This page says which data, why, who else receives it and how long it is kept. It describes what the software actually does, not what it might do one day.
Last updated: 17 October 2026.
Who handles your data
Crypto Master is published by MG INNOVATIONS, a company registered in France and the data controller within the meaning of Regulation (EU) 2016/679, the GDPR. Its full details — legal form, share capital, registered office, registration and VAT number — appear in the legal notice, which is their single source.
For any question about this page, or to exercise the rights set out below: write to us through the contact form. Our email address is not published here — robots would harvest it — but it appears on every one of your invoices. No data protection officer has been appointed; requests are handled through that channel.
What we handle, and why
Eleven processing activities, and no more. Each one comes with the ground that allows it.
Your account
Your email address, your password — of which we keep only a hash, never the word itself —, your first and last name if you fill them in, the date the account was created, the date you last signed in, and your display language. To these are added, for as long as they are valid, the single-use tokens sent to verify your address or reset your password.
Legal basis — performance of the contract — without an account there is no service.
Your portfolio data
This is the service itself: the transactions you import or that we read for you — date, type, amounts, assets, fees, the price the platform reported —, the exchange accounts and wallets you declare, the public addresses you track, and the decisions you record about your own movements, such as qualifying a transfer or setting aside a token you never asked for.
Legal basis — performance of the contract.
The export files you upload
When you import an export file — an exchange statement, a manual-entry CSV — and its import succeeds, the file is kept exactly as it was, together with its name, size, fingerprint, the date of the upload and the account it fed. It is there to give you back the evidence of what was imported, and to import it again if needed: you can find, download or delete it under “My uploaded files”. It is stored on our server, outside any public page, can only be reached, within the application, from your account, and is shared with no one. A file whose import failed is not kept, and the demo account keeps none.
Legal basis — performance of the contract — you are the one uploading the file, and you can delete it at any time.
Your exchange API keys
If you connect an exchange account through its API, the key, the secret and, where required, the passphrase are encrypted before they are written, and are never shown back to you. They are used only to read your history: Crypto Master places no orders and makes no withdrawals. A read-only key is enough, and it is the only kind you should hand over — to us or to anyone else.
Legal basis — performance of the contract, entirely at your initiative.
Your subscription and your invoices
The plan you subscribed to, its period, the identifiers Stripe sends back, and whatever an invoice must carry: name, postal address, country, and a VAT number if you declare one. Those details are copied onto each invoice at the moment it is issued rather than read again when it is printed: moving house does not rewrite your past invoices, because an accounting document is dated.
Legal basis — performance of the contract, then a legal obligation — an issued invoice must be kept.
Keeping your account safe
Every sign-in attempt is logged: IP address, the browser it declares, the address typed, success or failure, and the time. Counters limit repeated attempts. The sign-in, sign-up, forgotten-password and verification-email pages load Google reCAPTCHA, which sets cookies of its own to tell a visitor apart from a machine.
Legal basis — legitimate interest — protecting your account against automated attempts.
Two follow-up messages
A week after you sign up if no account is connected yet, then a week after your first imported transactions, we write to you once each at most, to ask what stopped you or what made you decide. These are plain-text emails, with no tracking image and no measured link; we keep only the date they were sent, for as long as your account exists. Replies are read by a person.
Legal basis — legitimate interest — understanding what holds our users back or helps them. You can object at any time, through the link at the bottom of each message.
Tax-season emails
If you agreed to it — through the optional, unticked box at sign-up, or in “My account” —, we may write to you to remind you of the filing dates and to give you our tips to prepare your figures. We keep the date of your consent and the version of the wording you accepted: that is the proof of your consent. Without it, you receive none of these emails. Messages about your account — security, billing — do not depend on this consent.
Legal basis — your consent, which you can withdraw at any time from “My account”: these emails stop at once, and we keep the date of your consent, its version and the date of withdrawal, as proof.
Audience measurement
On this public site only, and only if you have accepted, Google Analytics measures how the pages are visited. Until you answer, no third-party script is loaded and nothing is sent: there is no request, so no IP address leaves your browser. Google Analytics is never loaded in the application.
Legal basis — your consent, which you can withdraw at any time.
What led you to sign up
The links on this site that lead to the application — the demo, sign-up, pricing — carry what led you there: the page that serves them — an article, the home page —, or the link of a video, a partner or an ad through which you reached this site, which carries that name in its address. From one page of this site to the next, that name is taken from the address of the previous page, which your browser sends on its own: we read from it only the name of a page of our own site, and do not record it. The application keeps that name in your session — the session cookie described below, no extra cookie and no third-party service — then records it on your account if you sign up, along with whether or not you opened the demo. No IP address, no browser identifier, nothing of what you do elsewhere. It is kept with your account and deleted with it. Demo openings are also counted in a log that holds only a date, that name and the page of this site from which you opened it.
Legal basis — legitimate interest — knowing which content on our site helps people discover the service.
Reads of the blog and of three site pages
To know which content is read, each display of a blog article, of the home page, of the calculation method and of the page on filing crypto taxes is counted, with no cookie and no third-party service — whether or not you accepted audience measurement. We do not keep your IP address: only a fingerprint, computed with a key drawn at random every day and destroyed the next day, which lets us count once a visitor who comes back to the same page that day. Without that key, the fingerprint can no longer be linked to any address. The log holds the time, the page and that fingerprint, nothing else.
Legal basis — legitimate interest — knowing which content on our site is read.
What we do not do
- We do not sell or rent your data to anyone.
- We run no advertising and pass nothing to an advertiser or a data broker.
- No automated decision produces legal effects concerning you: there is no scoring, no profiling, no rating.
- We hold none of your crypto-assets and have no means of moving any. Crypto Master reads a chain and a history; it signs nothing.
Who else has access
Running this service takes service providers. Here they are, and what each one receives — no more, no less.
- OVH (France) hosts the server and carries our email. Everything described above therefore sits on its machines, in France.
- Stripe takes the payments. Your card details never pass through our servers and are never written there: you enter them on Stripe. What comes back to us is your name, your billing address, your country and a payment identifier.
- Google provides the reCAPTCHA on the access pages and, if you have accepted, the audience measurement on this site.
- YouTube (Google) plays the videos embedded in some blog articles — only when you click one of them: until that click, the page shows nothing but an image hosted by us, and nothing is sent to Google.
- The chain data providers — Alchemy, Ankr, Helius, Blockstream, Hiro — receive the public addresses of the wallets you track. There is no way around it: reading a chain means saying which address you are reading.
- The exchanges you connect through their API are queried with the keys you entrusted to us, read-only.
- The price sources — CoinGecko, DefiLlama, Frankfurter, Coinbase and a few others — receive no data about you: we ask them what an asset was worth on a date, never who holds it.
There is no other recipient. We disclose your data to an authority only where the law requires it.
Transfers outside the European Union
Your data is hosted in France. Some of the providers above are established in the United States or run servers there — Google, Stripe and several chain data providers among them. Those transfers rely on the safeguards those companies publish: the European Commission's standard contractual clauses and, for those certified under it, the EU–US Data Privacy Framework.
How long we keep it
Data you can no longer say why you keep is data you should erase. The periods below are the ones the software actually applies.
- Your account and your portfolio data — for as long as your account exists. You can ask for it to be deleted at any time.
- The sign-in log, IP addresses included — twelve months, then erased automatically every night.
- Address verification and password reset tokens — a few hours, until they expire; they are deleted the following night.
- The counters that limit repeated attempts — fourteen days.
- Payment events received from Stripe — thirty days; their only purpose is to stop the same payment being processed twice.
- Your invoices — ten years, as accounting law requires. They outlive the deletion of the account: an accounting document is not erased.
- The reading log (blog and three site pages) and its fingerprints — until the following night: each past day is then reduced to a number of views and visitors per page, and the fingerprint key is destroyed the next day.
- The export files you uploaded — for as long as your account exists, or until you delete them yourself. A deleted account takes its files with it: they are erased from the archive during the following night.
- Your consent to tax-season emails, its version and, if applicable, the date you withdrew it — for as long as your account exists: they prove what you agreed to, and when.
Your rights
The GDPR gives you rights over your data that we are bound to honour.
- Access — to know what we hold, and to obtain a copy of it.
- Rectification — to have what is inaccurate corrected.
- Erasure — to have your account and everything attached to it deleted, subject to what the law obliges us to keep, namely your invoices.
- Restriction and objection — to ask us to stop certain processing, in particular anything resting on our legitimate interest.
- Portability — to get your data back in a machine-readable form. Your transactions export to CSV from the application anyway, without having to ask anyone.
- Withdrawal of consent — for audience measurement, through the “Cookies” link at the bottom of the page. Withdrawing does not undo what was measured before.
Use the contact form, preferably giving the address on your account. We answer within a month. There is no button in the application today that deletes an account: the request is made through that channel, and it is handled by hand.
If our answer does not satisfy you, you may refer the matter to the French data protection authority — CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — or lodge a complaint at cnil.fr. You may also contact the supervisory authority of the country you live in.
How your data is protected
The site is served over HTTPS only. Passwords are not stored, only their hash. Exchange API keys are encrypted before they are written. The session cookie is out of reach of JavaScript, and changing your password invalidates sessions opened elsewhere. No arrangement is infallible: should a breach be likely to put your rights at risk, we would tell you, as the GDPR requires.
Changes to this page
This policy may change if the service does. The date it was last updated is at the top of this page. A change that would call for fresh consent from you would be brought to your attention, not slipped into a silent update.